We currently run v6.4.10 for our FMG-VM and manage bigger customer's FortiGates(FGTs) totalling about 600 (soon to be 800+).
And one of them needs one VIP group (two VIPs) at all 500+ locations. We use policy packages for this customer to standardize their policies, which is almost the same at all locations.
But when I looked at the VIP object config under Policy&Objects->Object Configurations->Firewall Objects->Virtual IPs then hit "Create New->Virtual IP", I don't see a way to select a dynamic address object for the External IP and Mapped IP.
This means we need to create 500+ x 2 VIPs manually putting each IP, then worse, we need to create 500+ different policies and use "Installation Target" to be for one specific FGT.
Is there a better way to have just one policy for one VIP group for 500+ FGTs?
Or, can I use meta fields+CLI template to define those on Device DB side and somehow let the policy to refer to the VIP group name?
Ok, my screen on the laptop was too small and I didn't scroll down all the way to the bottom to see "Per-device Mapping" ON/Off sliding switch. So VIPs can be actually dynamic objects I can configure different IP per-device. I'll use this feature.
I was thinking the meta fields method would probably work using a CLI template to define VIP config in Device DB instead of an object in the Policy&Object. But it might at least confuse our techs and might cause conflict when someone who doesn't know about the CLI template tries to create a VIP in the object DB temporarily to test something at one of locations.
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.